Medium severity · published Oct 12, 2026
CVE-2026-109292
Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections
6.8
CVSS
0.4%
EPSS
No
On KEV
Description
Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, including administrators.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
open-webui · open-webui
0.6.27 before 0.11.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-109292
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-109292
vendor-advisory
https://github.com/open-webui/open-webui/security/advisories/GHSA-gqfh-jxvw-74rp
patch
https://github.com/open-webui/open-webui/commit/f9f815c86220f809fad5ee1300c44f55dea74c79
patch
https://github.com/open-webui/open-webui/commit/b71744b17823f7a3a9a64cb363e79a7164ed5b23
patch
https://github.com/open-webui/open-webui/commit/3cda47cdb449aac970426f0929c9e5f8bb8bd807
third-party-advisory
https://www.vulncheck.com/advisories/open-webui-0.6.27-before-0.11.4-session-token-disclosure-via-oauth-mode-connections
More from open-webui
9.8
CVE-2026-44566
Open WebUI: Arbitrary File Upload and Path Traversal
9.6
CVE-2026-56400
open-webui - Remote Code Execution via CORS Misconfiguration and Session Validation
9.1
CVE-2026-44551
Open WebUI: LDAP Empty Password Authentication Bypass
9.0
CVE-2026-56398
Open WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URI
9.0
CVE-2026-59216
Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id